Description
Multiple directory traversal vulnerabilities in GNU binutils 2.24 and earlier allow local users to delete arbitrary files via a .. (dot dot) or full path name in an archive to (1) strip or (2) objcopy or create arbitrary files via (3) a .. (dot dot) or full path name in an archive to ar.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145746.html ↗
- http://secunia.com/advisories/62241 ↗
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:029 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=1162655 ↗
- http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148438.html ↗
- http://www.ubuntu.com/usn/USN-2496-1 ↗
- https://sourceware.org/bugzilla/show_bug.cgi?id=17552 ↗
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html ↗
- http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147346.html ↗
- http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145352.html ↗
- http://www.openwall.com/lists/oss-security/2014/11/13/1 ↗
- https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=dd9b91de2149ee81d47f708e7b0bbf57da10ad42 ↗
- http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148427.html ↗
- http://secunia.com/advisories/62746 ↗
- http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147354.html ↗
- http://www.securityfocus.com/bid/70908 ↗
- http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145256.html ↗
- https://sourceware.org/bugzilla/show_bug.cgi?id=17533 ↗
- https://security.gentoo.org/glsa/201612-24 ↗